Best Wishes for a Happy, Healthy and Safe New Year 

Dear Valued DPSAC News Subscriber  

In 2014, DPSAC and the HSPD-12 program office remained focused on the continued implementation of HSPD-12. As part of these efforts, a number of changes were implemented at NIH this past year.      

Card reader upgrades were completed at NIH facilities. The NIH workforce was called on to adopt a new way of using their PIV Cards (HHS ID Badges) in their daily work routine. This past year NIH transitioned to new PIV Card readers at NIH vehicle and pedestrian entrances at the perimeters of NIH campuses (Bethesda, MD, Bayview Research Center, Baltimore, MD and Rocky Mountain Laboratories, MT).

The new system required PIV Card holders to change the way they used their cards with the readers. With the old system, a user merely had to wave his or her badge near the reader to open the gate. The new system requires a user to remove his or her badge from the protective holder and position it so that it makes contact with the reader to signal the gate to open.

Thanks to careful planning, execution and cooperative efforts by many stakeholders, and the patience of the NIH workforce, NIH transitioned to the new card reading system with minimal disruption and inconvenience.

DPSAC and the HSPD-12 Program Office oversaw the implementation of several additional badging policy and procedural changes in 2014

In July, NIH began issuing a new "Restricted Local Access" (RLA) badge to NIH staff who fall into one of three categories: short-term staff at NIH less than six months; summer students and foreign nationals.

NIH worked with HHS to develop the RLA Badge in order to meet HSPD-12 security guidelines for individuals who do not qualify for an HHS ID Badge (PIV Card).       

In September, NIH implemented revised procedures for issuing "Extended Visitor" badges. NIH Extended Visitor badges are issued to individuals affiliated with NIH who need frequent physical access to NIH facilities.

An individual applying for an extended visitor credential must now be authorized and sponsored by Administrative Officers (AOs) who have been certified by DPSAC to sponsor federal employees, contractors and affiliates for HHS ID Badges (PIV cards).

As of October, NIH employees, contractors and affiliates may be issued a PIV Card (HHS ID badge) only after: (1) their fingerprint check is adjudicated; (2) they complete and submit to DPSAC their e-QIP and related forms necessary to conduct a background check, and; (3) DPSAC reviews their e-QIP and related forms and releases them to OPM. These steps are now required before DPSAC can issue a PIV Card to the individual.

A second video on the HHS ID Badge Issuance Process, titled 'Getting an HHS ID Badge,' explains the process of getting an HHS ID Badge and outlines the four steps that make up the badge issuance process. Both videos are now posted on the NIH YouTube channel.

The HSPD-12 Program office collaborated with the NED team and NIH Human Resources to communicate the launch of the Emergency Tier Designation functionality in NED to the NIH community. Important functional enhancements to NED provide the capability to collect and manage NIH employee Emergency Tier Designation (ETD) information and make this data available for use by external systems.

We would like to once again thank everyone who helped NIH achieve these impressive results, including DPSAC and HSPD-12 Program Offices staffs, the NED Team, the IT Branch in ORS, as well as the NIH administrative community and other stakeholders at NIH.

Best wishes for a happy, healthy, safe and productive New Year to you and your families.  

Richie Taffet    

Program Manager, HSPD-12 Program Office   

Board Members and the Badging Process

Distinguishing Between Special Government Employees (SGEs), Representatives and Federal Employees for Badging Purposes

On September 2, 2014, NIH implemented revised policies and procedures for issuing "Extended Visitor Badges" (a type of NIH Legacy badge) as part of a continuing effort to improve security at NIH. These changes were conveyed to the Administrative community via a November 3, 2014 e-mail from the HSPD-12 Program Office (see: New Extended Visitor Badge Application Policy [pdf]) and in DPSAC News articles (e.g., September 17, 2014 DPSAC News).

Each year NIH's National Advisory Councils/Boards, Boards of Scientific Counselors and Program Advisory Committees replace one quarter of their members. Below is an explanation of the three classifications of board members and the required level of background check for each one.

Board Members at the NIH may include the following classifications of individuals:

1)    Federal Employee - NIH Federal Employee, who has a PIV Card issued by NIH, or Non-NIH Federal Employee, who has a PIV Card issued by another Federal entity. This individual is in the NIH Enterprise Directory (NED) and subject to the requirements to obtain a PIV Card. Please note that if a federal employee already has a PIV Card, he/she will not be required to complete additional background checks to serve as a Board Member.

2)    Special Government Employee (SGE) - is a member of an NIH Advisory Council, Board of Scientific Counselors or Program Advisory Committee who receives an honorarium and/or per diem and travel benefits as if a federal employee.

The Secretary of the Department of Health and Human Services, the Director of NIH, or the Director of an Institute/Center(IC) appoints these individuals to serve on an NIH Advisory Council, Board of Scientific Counselors, or Program Advisory Committee. This individual is in NED and must be fingerprinted to obtain an NIH ID (Legacy) Badge. This individual is not a federal employee or a contractor.

3)    Representative - This individual is a representative of an organization outside of the federal government, (e.g., the American Lung Association), and not compensated in any way by the NIH. This individual is not in NED and is subject to a name check (NCIC) to obtain the NIH ID (Legacy) Badge. Please note that this individual will not be fingerprinted. S/he is not a federal employee or a contractor.

Individuals who serve on an IC's Initial Review Group and do not fall into any of the aforementioned categories are subject to a name check (NCIC) to obtain the NIH ID (Legacy) Badge.

Individuals who are entered into NED are subject to a minimum of a fingerprint check regardless of whether they receive an NIH ID (Legacy) Badge.

        Process for Requesting an Extended Visitor Badge (Legacy Badge)
        for SGEs

1. The IC Administrative Officer (AO) must enter the SGE into the NIH Enterprise Directory (NED) and sponsor the individual for an ID badge. This will notify the NIH Police that a badge has been requested.
    
2. The NIH Police will send the individual an e-mail requesting they complete the Extended Visitor Badge Application form (pdf).
   
   
3. Once the form has been completed and submitted, the NIH Police will electronically capture the individual's fingerprints.
    
4. The NIH Police will issue the ID badge as soon as the SGE has submitted his/her fingerprints.
    
5. The NIH Police will confirm the results of the fingerprint check. the Security and Emergency Response office will contact the IC in the event of an unfavorable result.

         Process for Requesting an Extended Visitor Badge (Legacy Badge)
         for Representatives  

1. The Representative fills out the Extended Visitor Badge Application form (pdf) noting that he or she is a Board Member.
    
2. The Representative submits the completed form to the NIH Police for the name check (NCIC).
   
   
3. The NIH Police then conducts the name check (NCIC).
   
   
4. The NIH Police will issue the NIH ID (Legacy) Badge to the Representative as soon as the name check (NCIC) results return favorably.
   
   
5. If the results come back unfavorable, the Security and Emergency Response office will contact the IC.

How to Obtain PIV Sponsor Authority

An AO who wishes to obtain sponsor authority must complete the training found on DPSAC's website under the 'Training/Administrators' section (http://www.ors.od.nih.gov/ser/dpsac/Training/Pages/administrators.aspx) and fax the completion certificate to the HSPD-12 Program Office at 301-480-0108. If the fax does not go through, s/he should send the PIV Sponsor Certificate via e-mail to Richie Taffet (Taffetr@mail.nih.gov).  

Upon receipt of the certificate, the Program Office will authorize the AO as a sponsor. 

Once the Program Office grants sponsorship privileges, the AO will see the "Awaiting Sponsorship" menu option in the left navigation panel on the NED screen.   

Whether you are new to NED or an advanced NED user who needs to hone your NED skills, the HSPD-12 Program Office has a training program for you. These classes are designed to help beginners and advanced users quickly master NED in a hands-on computer lab environment. All classes are FREE!    

How to Enroll

The NED courses are posted on the CIT Training site where visitors can view availability for any class and receive a confirmation immediately after registering. The catalog of NED classes is posted at: http://training.cit.nih.gov/coursecatalog.aspx under "General Seminars." 

When you see a course you want to take, just click on the course name (listed in the right column of the table). You will be taken to the HHS Learning Management System (LMS) where you can register for the course online.

To log onto the HHS Learning Management System, you can use either your PIV card and PIN or your NIH credentials. If you experience any difficulties accessing the LMS, please contact the CIT Training Program at 301-594-6248 or send an e-mail to: cittraining@mail.nih.gov.    

DPSAC News - 2014 in Review

Some headlines & excerpts from past issues of DPSAC News in 2014. Clicking on the date will take you to the published issue of that newsletter.

As part of this process, your AO will review your personal, position and duty station information and may ask you to verify or submit any updates.  Your AO will then sponsor you in NED for your renewal HHS ID Badge.   

HHS ID Badge Renewal

Once your AO has sponsored you for your renewal HHS ID Badge, you will be sent an e-mail from DPSACScheduler@mail.nih.gov asking you to log on to the appointment scheduling system.

In most cases you will be asked to schedule only an HHS ID Badge issuance appointment. In some cases you will be asked to schedule both an enrollment and HHS ID Badge issuance appointment so that DPSAC can complete your background investigation.

HHS ID Badge Issuance   

When you come to your Badge Issuance appointment, please be sure to bring a federal or state issued photo ID with you. Your ID must be current (i.e., not expired). You will be required to turn in your existing HHS ID Badge.

FAQs

Q. When an employee or associate changes position (for example, a lab chemist becomes the lab or branch chief), should their AO update NED with the new position title?    

A.Yes. The AO should update NED with the new position title, as the new position may necessitate a different or new background investigation.     

Those who have not undergone the PIV process will need to schedule an appointment with Personnel Security to be fingerprinted and have their background investigation initiated.   

Once the AO requests a replacement HHS ID Badge, the lost or stolen HHS ID Badge will be deactivated and will no longer work, even if it is found later.    

Helpful Tips

ICs that want to add LWS operators to the approved roster --  send a written request to Richie Taffet at: taffetr@mail.nih.gov. Your request should include the new operator's name, their IC, their NED number, as well as the operator's e-mail address, building/room and phone number. 

New policy requires re-issuance of lost or stolen HHS ID Badges -- beginning December 16, 2013, once an applicant reports his or her HHS ID Badge lost or stolen and the AO records this in NED, the AO will no longer have the ability cancel the re-issuance task and restore the operation of the badge. The applicant will need to go through the badge issuance process to receive a new HHS ID badge.

Once Mr. Taffet has approved the request, he will forward the name(s) to HHSIdentityAdmins@deloitte.com to complete the approval process, add the name to the LWS operator roster and inform the IC that the individual is now approved to operate the LWS.

Safety Corner

Help Us Help You! - Know How to Spot Common Fire Safety Hazards in the Workplace  

This fire safety awareness article was prepared by the Division of the Fire Marshal, ORS, NIH 

The Division of the Fire Marshal, Office of Research Services, is once again kicking off the New Year with a fire safety awareness outreach campaign with the NIH community entitled "Help Us Help You! - Know How to Spot Common Fire Safety Hazards in the Workplace."

Even though all facilities on the NIH Bethesda and Poolesville campuses are surveyed by the Division of the Fire Marshal (DFM) on a regular basis, fire-safety hazards in the workplace can still pop up. With this in mind, the NIH community should not assume the DFM is aware of and/or working to correct every fire safety hazard.  

Peer responsibility plays a large part in keeping NIH facilities fire safe. Therefore, it is extremely important for the NIH community to be able to spot and correct the more common workplace fire safety hazards before a fire incident occurs.  

January 22, 2014 DPSAC News

Video Features Personal Identity Verification (PIV) Process Overview 

Did you know that the DPSAC website offers an easy-to-follow training video on the Personal Identity Verification (PIV) Process?

The video is designed to quickly familiarize the viewer with this common credentialing and standard background investigation process that is required by Homeland Security Presidential Directive 12 (HSPD-12).  

To view the video, go to http://www.ors.od.nih.gov/ser/dpsac/Training/Documents/nih_deploy/piv.html, click on the Personal Identity Verification (PIV) Overview image, then click 'Begin Training' in the right navigation panel to begin the video tutorial.         

FAQs

Q. Since I'm getting fingerprinted and a new picture, I'm assuming I'll be getting a new card. Therefore, do I need to renew my digital certificates?

A. If you get a new card, then you will receive updated digital certificates and will not have to renew your digital certificates in accordance with the message below.

How to Recover Your Old (Expired) Digital Certificates -- if you want to read signed or encrypted e-mail messages that you sent or received using a now-expired certificate, you first need to recover that certificate from the HHS Identity PIV Portal. For instructions on how to recover your old certificates, visit: http://www.ors.od.nih.gov/ser/dpsac/Documents/How_To_Recover_Certs.pdf 

February 5, 2014 DPSAC News

Not Entering New Hire Information into NED prior to EOD Likely to Delay Badge Issuance for Days, Weeks or Longer!

Until now, DPSAC has been able to issue an HHS ID Badge once DPSAC has received confirmation back from OPM that the fingerprints are 'clean,' and DPSAC has received the completed e-QIP forms from the new hire.  

Due to recent updates to the Federal standards (FIPS 201-2) regulating the implementation of HSPD-12, NIST and OPM are now requiring all agencies to hold off issuing new badges until each individual's e-QIP forms have been submitted by the candidate, reviewed by the respective agency and released to OPM. Note: there are NO exceptions! 

For DPSAC to meet this new challenge -- of reviewing each candidate's e-QIP forms and releasing them to OPM -- it's imperative that AOs enter the individual into NED prior to EOD. If an individual is not entered into NED prior to EOD, DPSAC will not have access to the information it needs to review the case prior to submitting the questionnaires to OPM.  

This delay will have a domino effect, and will likely cause the applicant to wait several weeks to get his or her new HHS ID Badge. DPSAC is urging AOs to put these individuals in NED as early as possible to avoid this major inconvenience to their new staff members.  

FAQs  

Q. What does 'Position Sensitivity Level' refer to? 

A. Each position at NIH is assigned a level of risk and sensitivity that determines the kind of background check that is required for that position. A position sensitivity worksheet, Form NIH-2866, summarizes personnel security/suitability requirements.

The majority of NIH employees and contractors are in non-sensitive "Level 1" positions and will undergo a 'National Agency Check with Inquiries' (NACI). This is the minimum investigation required for new federal employees, contractors and affiliates.  All NIH personnel security investigations are processed through the Office of Personnel Management (OPM).

Prevent Fires in Your Kitchen

The following fire safety article was prepared by the Division of the Fire Marshal, Office of Research Services

The #1 leading cause of home fires and fire injuries is kitchen fires!

More home fires start in the kitchen than anywhere else.  In 2011, cooking was involved in an estimated 156,300 home fires that caused 470 deaths, 5,390 injuries, and $1 billion in property damage. 

February 19, 2014 DPSAC News

HHS Expands Policy on Usage of Unauthorized External Information Systems to Conduct Department Business

DPSAC News is reprinting the following HHS memo, dated January 30, 2014, regarding the "Usage of Unauthorized External Information Systems to Conduct Department Business," as a reminder of the guidelines set forth concerning the transmission of sensitive information.

'Everyone who is assigned an HHS-provided e-mail or online storage account must use those government-provided resources for conducting any and all official HHS business:

In no case should staff conduct official HHS business using personal e-mail or personal online storage accounts if a federally-owned or federally-contracted alternative is assigned to them...'

Beginning immediately, the NIH will begin efforts to enforce the removal of Personally Owned Equipment from NIH VPN access. This includes contract-supplied computers.

Do not lend your HHS ID Badge (a.k.a. Smart Card, PIV Card) to anyone!  -- lending out your PIV Card (HHS ID Badge) is prohibited. The issuance of the HHS ID Badge is based on strict identity proofing and the determination of one's suitability for a specific position classification.

March 5, 2014 DPSAC News

 

Coming in April - New PIV Card Readers at All Entrances along NIH Campus Perimeter

Drivers and pedestrians will be able to try out the new readers at test sites starting mid-March.

The NIH will soon replace the card readers currently used at all NIH campus perimeter entrances and pedestrian portals with a more secure card reader as part of the agency's continued implementation of HSPD-12.

The new readers will operate differently. Unlike the old readers, which allowed users to place their cards NEAR the reader to open the gate or portal, the new card readers require individuals to REMOVE their PIV card from its holder, TOUCH AND HOLD the card flat against the face of the reader, and WAIT until a green light and beep signal that the gate or turnstile is unlocked.  

Pilot sites will deploy in mid-March to let NIHers test their PIV Cards

Because these new readers will require PIV Card holders entering the NIH campus to adopt a new way of using their PIV Cards, NIH wants to give everyone an opportunity to try out their PIV Card with the new readers.

Beginning around March 18, 2014, NIH will activate kiosks installed in the lobbies of several high-traffic buildings. The NIH Police will also open a vehicle test lane at the same time for drivers to try out the new readers... .

NIST and OPM Now Requiring Agencies to Review and Release e-QIP Before Issuing Badges

Due to recent updates to the Federal Information Processing Standards (FIPS 201-2) regulating the implementation of HSPD-12, the National Institute of Standards and Technology (NIST) and the Office of Personnel Management (OPM) are now requiring all agencies to hold off issuing new badges until e-QIP forms have been submitted by the candidate, reviewed by their respective agency and released to OPM.

Note: there are NO exceptions!

For DPSAC to meet this new challenge -- of reviewing each candidate's e-QIP forms and releasing them to OPM -- AOs will need to enter new employees, contractors and affiliates into NED as soon as possible, and prior to EOD.

March 19, 2014 DPSAC News

Top 5 Reasons OPM Rejects and Returns Forms to the Submitting Agency

The March 5, 2014, issue of DPSAC News reported that the National Institute of Standards and Technology (NIST) and the Office of Personnel Management (OPM) now require, without exception, all agencies to hold off issuing new badges until e-QIP forms have been submitted by the candidate, reviewed by their respective agency and released to OPM.

The most common quality errors and the overall rate of occurrence cited by OPM are:  

     1.     Required forms (eQIP, Releases, OF-306, fingerprints) not signed,  

             dated, or submitted: 44%      

     2.     Subject's background information missing or discrepant

             results:  22%      

     3.     Subject identifying data missing or discrepant: 13%      

     4.     Amendments to the forms require subject certification: 10%      

     5.     Submitted forms outdated: 8%

April 2, 2014 issue of the DPSAC NEWS

Need to make changes to the LWS operator directories? -- drop an e-mail to Lanny Newman, newmanl@mail.nih.gov, and let him know what needs changing (e.g., adding new operators or LWS locations, removing operators, etc.). Remember, before a new operator can be added to the LWS directory, s/he must first be approved by Richie Taffet (see preceding Helpful Tip).  

If an LWS is not available in your IC or your immediate area, and you work in the greater Bethesda or Rockville area -- please call 301-451-4766 or 301-402-9755 to schedule an appointment with the Division of Personnel Security and Access Control located in Building 31, Room B1A26 or in Building 10, South Lobby, Room 1C52.    

If you work outside the Bethesda/Rockville area, contact your local badge issuance office. You can find contact information for all badge issuance offices at: http://www.ors.od.nih.gov/ser/dpsac/Pages/contactinfo.aspx.   

Experts Share Tips on Getting Good Fingerprints at a Lifecycle or Enrollment Work Station

From time to time, LWS operators and PIV Card Enrollment specialists encounter a candidate whose fingerprints just won't reveal themselves properly on the LWS or EWS fingerprint reader. Below are a few tips and best practices offered up by DPSAC and LWS operator specialists for getting good fingerprints.  

Try these useful tips if the fingerprint is not visible or very faint:

• Have the applicant wash their hands. Be sure the fingers are clean and dry.    
• Clean the verifier. It is always good practice to clean off the machines before an applicant arrives to have a clean surface to capture the best prints!  
• Apply 'PreScan,' or hand lotion. Some specialists have found moistening the fingers using a water-moistened tissue helps define the ridges on the applicant's fingertips.
• Use a light touch. Many people press down too hard on the glass. A light touch is all that's needed, and is actually better than pressing too hard.         

April 30, 2014 issue of the DPSAC NEWS

The New PIV Card Readers Will Make Access to the NIH More Secure

The new PIV Card Readers being installed at the NIH Bethesda campus perimeter entrances take advantage of the PIV Card's advanced technology to offer improved security for the NIH workforce and NIH facilities.

The PIV Cards and new PIV Card readers operate at a frequency signal (13.56 MHz) that uses electronic induction similar to Metro Smart Trip cards.  

The cards remain in a passive state until they are electronically "induced" and activated by the new card reader or "induction source." This is generally more secure since the card is not continually broadcasting a signal, as in the case with the current technology that operates at a different frequency signal (125 KHz).

This new standard sets the groundwork to use the digital certificates enclosed in the cards for physical access. The certificate structure is designed to prevent cloning and unauthorized duplication of credential information. This is outlined in the Federal Identity, Credential and Access Management (FICAM) Roadmap and will be initiated at NIH facilities in the future. 

With Improved Identity Management Comes Improved Security

Identity management is a key concern of IT. One of the stumbling blocks to identity management has been the 'siloed' or 'stove-piped' systems created over the past decade.  

The advanced technology in these PIV Cards allows them to be configured so that if someone from another agency who had access to an NIH system was terminated or fired, the Federal Physical Access Control System architecture could detect that and prevent access -- part of the objective of the HSPD-12 orders put in place by the Executive Branch of government.

May 14, 2014 DPSAC News

Note: summer students under the age of 18 must also provide parental or legal guardian consent prior to the NCIC check.

Adding Summer Students to the NIH Enterprise Directory (NED)

All incoming summer students must be added to the NIH Enterprise Directory (NED) and sponsored for an NIH ID (Legacy) Badge before they can be granted physical access, and a network account if they require logical access... .

FAQs
Q. How does this the implementation of the new PIV Card readers affect Extended Visitor badges [NIH Legacy badges]?

 A. The PIV Card readers will be programed to differentiate between PIV Cards and NIH Legacy badges to allow them both to work.

May 28, 2014 issue of the DPSAC NEWS

* The PIV Card comes equipped with two antennas. The old PIV Card reader uses the antenna that works at a frequency that can operate by proximity. The new PIV Card reader uses the antenna that must be in contact with the reader to operate properly.  

PSC Regional Office Directory Updated - PSC recently updated its directory of PSC Regional Administrative Managers for its 10 Regional Offices. The revised directory is posted on the DPSAC website at: http://www.ors.od.nih.gov/SER/DPSAC/BADGE/Pages/badgingremote.aspx. There you'll also find guidelines for NIH ICs needing HHS ID Badge (PIV Card) Enrollment, Issuance and Maintenance Services at remote locations.   

NIH Information Security & Privacy Awareness Training Offered as One Course for 2014!

This article was prepared by Karen Plá, NIH Office of the Senior Official for Privacy & Cheryl Seaman, NIH Office of the Chief Information Officer

To reduce the burden of having to complete two mandatory trainings, the Information Security and Privacy Awareness Refresher courses have been combined into one course. The new format includes Information Security and Privacy modules and provides a bookmarking feature that allows you to return to the location where you left the course.  

June 11, 2014 issue of the DPSAC NEWS

 

Changeover to New PIV Card Readers at All NIH Campus Perimeter Entrances Imminent

Steps you can take to get ready

Be prepared! That's the message DPSAC wants to convey to all employees, contractors and affiliates as ORS gets ready install the new PIV Card readers at all entrances along the NIH campus perimeter.  

With the retrofitting of all pedestrian entrances scheduled during the week of June 21 and all vehicle entrances over the June 28/29 weekend, there's still plenty of time to try out your PIV Card at one of the test kiosks installed around campus (and the BRC).

ORS is recommending you test your PIV Card at one of these kiosks before the changeover to ensure that your PIV Card works properly with the new reader and to avoid unnecessary delays.

Holders of Defective Badges Expiring Within 180 Days Qualify for Early Renewal

Individuals who discover their PIV Card is broken and their card has an expiration date within 180 days should contact their AO for an early badge renewal.  

Under these circumstances, an AO can use the 'Renew Badge' feature in NED to begin the badge renewal process immediately. NED will not automatically generate a badge renewal task until six weeks prior to the badge's expiration date. 

New Employees, Contractors and Affiliates Must Complete & Submit e-QIP to DPSAC Before PIV Card Can Be Issued!

Effective October, 2014, revised federal policies prohibit the issuance of a badge until the following are completed:

1. Fingerprint checks are adjudicated
2. e-QIP and related forms necessary to conduct a background check are completed and submitted by the individual to DPSAC
3. e-QIP and related forms are reviewed by DPSAC and released to OPM (new requirement)

Soon after being entered in NED, the new employee, contractor or affiliate will receive an email with the subject line: **MANDATORY** RE: Background Investigation Forms.  

Individuals who have the appropriate investigation on file will not be required to complete new forms.

Once the online forms are complete, the individual must click the "Release Request/Transmit to Agency" button or NIH will not receive the forms.

Important: the individual must complete and submit these online forms within 7 calendar days of receipt (instructions are provided via e-mail) and prior to their first day. The forms can be filled out on any computer with web access.

Operation "Clean Sweep" Coming to an NIH Building Near You!    

The following message was sent to all DC-area NIH staff on June 6, 2014 

Some public areas in and around NIH buildings have become cluttered with unsightly and unsafe materials, trash, surplus furniture and equipment. Employees leave items behind in atriums. Loading docks become storage areas or dumping grounds. Hallways become extensions of offices and laboratories, at the expense of safety and egress.

During the months of June, July and August, on Tuesdays and Thursdays, the NIH Bethesda Campus will undergo a "Clean Sweep" of common spaces in many buildings.  

Led by the Office of Research Facilities (ORF) and the Office of Research Services (ORS), the team will focus on recycling, removing debris, moving unwanted items to surplus, and clearing common areas, leaving behind a safe and 'clutter free' building.  

June 25, 2014 DPSAC News 

New PIV Card Readers Debut at All NIH Main Campus Perimeter Entrances

Starting Monday morning, June 30, 2014, NIH will activate the new PIV card readers controlling access to all NIH main campus perimeter entrances.  

Drivers and pedestrians with PIV cards who enter the NIH campus will need to remove their cards from their protective cases, and then touch and hold the cards to the face of the readers to open the gate or turnstile.      

NIH To Begin Issuing New 'Restricted Local Access (RLA) Badge' in July, 2014

NIH will soon begin issuing a new type of identification credential, the Restricted Local Access (RLA) Badge to NIH staff who fall into one of three categories:

1.  Short-term staff at NIH less than six months   

2.  Summer Students beginning in 2015

3.  Foreign Nationals

Release of the new badge... will occur later in July once DPSAC is in receipt of the card blanks used in printing the new badges. DPSAC will notify the administrative community when the new badges become available.

When an AO requests an ID badge in the NIH Enterprise Directory (NED) for anyone in these categories, an RLA Badge will automatically be triggered.  While this change should have no impact on the current NED workload for the administrative community, DPSAC wants to make sure the community is aware of these important changes to avoid any confusion. 

The RLA Badge lifecycle 

The RLA Badge is valid for 3 years when issued to foreign nationals. RLA Badges issued to short-term staff are valid for a maximum of 6 months. When RLA Badges are issued to summer students...they will be valid through September 30 of the year issued.

NIH worked with HHS to develop the RLA Badge in order to meet HSPD-12 security guidelines for individuals who do not qualify for an HHS ID Badge (PIV Card).  

The new RLA Badge is an NIH-issued smart card that can be used for physical access to NIH facilities and logical access to NIH information systems, and will allow people in the above categories to log in to NIH networks in a more secure fashion.

The Process to Get an RLA Badge

The process to get an RLA Badge will be similar to the PIV process used to issue HHS ID Badges.

  1. Badge request in NED

     When you request an ID badge for anyone in the above categories, NED will
     automatically default the request to an RLA Badge.

  2. Enrollment appointment with DPSAC

     All individuals receiving an RLA Badge will need to complete an enrollment
     appointment with DPSAC. Enrollment appointments ... consist of identity
     proofing, fingerprint capture and a photograph.

  3. Background investigation forms

     Everyone receiving an RLA Badge must complete the appropriate background
     investigation. Short-term and intermittent staff will undergo a fingerprint
     check only (cost to the IC of $21.50). Foreign nationals will undergo the
     appropriate investigation based on their position at NIH and length of time in
     the United States. DPSAC will ensure that individuals receive the appropriate
     forms to complete (if required).

   4. Badge issuance

      Once all of the above steps are completed, individuals will be instructed to
      schedule an appointment to pick up their RLA Badge.

Special Notes Regarding Foreign Nationals

1. Badge expiration dates: NIH sees a large number of foreign nationals who join our workforce each July. If these foreign nationals have a badge requested in NED before July 14, NED will default to a 5 year HHS ID Badge. Any badge requests for foreign nationals after July 14 will be defaulted to a 3 year RLA Badge.

To avoid confusion among your foreign national staff, ICs may want to begin adjusting the expiration date in NED to 3 years instead of 5 years for any HHS ID Badge requests made before July 14. This would help ensure that all new foreign nationals in your IC receive a badge for the same length of time.

2. No Social Security Number: Please be advised that DPSAC will NOT issue any type of ID badge to individuals without a Social Security Number (SSN). Individuals without an SSN must access the NIH facilities as a daily visitor.

3. Alien Authorized to Work Until Date (AAWUD): The Division of International Services (DIS), ORS, must clear all foreign nationals placed at the NIH before badge issuance. This clearance ensures that foreign nationals are lawful to be in the U.S. and are authorized to work at the NIH.

The AAWUD is an important date in that it marks the end date of a foreign national's work authorization, which is determined by the DIS and entered by the DIS into NED.

Please note that if the AAWUD lapses, NED will immediately initiate a revocation of the affected foreign national's ID badge. Therefore, it is important for the NIH administrative community to initiate new or renewal requests to the DIS in a timely manner to avoid unnecessary revocation.  

At the three-year mark of residence in the U.S., a background check requirement will be triggered and the IC will be billed accordingly.   

On Monday morning, June 30, 2014, NIH activated the new PIV card readers controlling access to all NIH main campus perimeter entrances.   

Throughout the week, extra guards stationed at all 13 vehicle entrances assisted drivers during the busy morning hours as they became familiar with the new process for entering the campus.

An informal survey of the guards by the Division of Personnel Security and Access Control (DPSAC) during the first week of activity with the new readers turned up few problems.  DPSAC staff reported that most individuals were able to enter the main campus without difficulty.

Why NIH has installed the new PIV Card readers

HHS mandated the installation of the new reader system at NIH to comply with Department security policies relating to Homeland Security Presidential Directive 12 (HSPD-12).  This is a government-wide policy that affects every federal agency.

July 23, 2014 issue of the DPSAC NEWS   

NIH Begins Issuing the New Restricted Local Access (RLA) Badge 

On July 14, 2014 NIH began issuing the new NIH ID credential - the Restricted Local Access (RLA) badge - to NIH staff falling into one of three categories:

• Short-term staff (at NIH less for than six months)      
• Foreign nationals (non-US citizens)  
• NIH summer interns  

NIH Temporarily Unable to Issue 'Extended Visitor Badges' to Persons Requiring a Background Check

Due to several issues experienced recently with our ability to access the FBI's criminal history database, we are temporarily unable to issue extended visitor badges to persons requiring a background check. ORS is working diligently to establish an alternate means of conducting the required criminal history checks. This alternative procedure is expected to be online by September 1.

Alfred C. Johnson, Ph.D.

Director

Office of Research Services

National Institutes of Health

Don't Let Your PIV Card Expire While on Travel or Extended Leave

Employees, contractors and affiliates who will be traveling (or plan to be away from their duty station) for extended periods of time should make sure that their badge does not expire during their absence.

If an individual's badge is scheduled to expire during a prolonged absence, they should contact DPSAC or their AO to have their badge renewed in advance.

Once a badge expires, it is deactivated and the individual will no longer have physical or logical access to NIH facilities or NIH networks.  

Proper Handling of PIV Cards When Staff Separate or Leave NIH

DPSAC wants to remind AOs who clear employees, contractors or affiliates for separation or transfer that they must collect that person's PIV Card (HHS ID Badge) and return it to DPSAC once they have deactivated the individual's NED record. DPSAC would also like to remind staff that the badge should not be altered in any way. 

August 6, 2014 issue of the DPSAC NEWS

 

Understanding the Requirements for Hosting Foreign Visitors

The HHS Operating Divisions (OpDIVs), including NIH, and the Office of the Secretary (OS), host visitors from other countries from the national scientific and policy communities, international organizations and the private sector.

The Office of Security and Strategic Information (OSSI), OS, provides oversight for the HHS Foreign Visitor Management Program (FNVMP).  

This program provides guidance to the OpDIVs and OS regarding foreign national visit requests and for the restrictions of foreign national visitor access to certain areas and materials. In addition, the Department's Foreign Visitor Management Policy provides standards and implementing guidelines for the HHS FNVMP.  

Purpose of the Foreign Visitor Management Policy 

These policies are to be followed by the Department and its OpDIVs "to protect government property and sensitive information and to ensure the safety and security of employees, contractors, and visitors to HHS- owned, leased or occupied property... ."   

The OSSI will review and approve or disapprove all foreign national visit requests received through the FNVMS from "designated countries" and all foreign national visits to critical infrastructure specifically identified by the OpDIVs. Designated countries are those nations identified as a State Sponsor of Terrorism by the U.S. State Department.

 

Advanced Authorization Required  

If the visitor is from a country identified as a State Sponsor of Terrorism, the host must file an access request form (see: Foreign Visitor Data Request Form) with the NIH Police at least ten (10) days prior to the visit.  Failure to provide the required information 10 days prior will inevitably lead to delays or possible denial of access to NIH facilities for the visitor from a state sponsor of terrorism. 

IT Restrictions 

Once in NIH facilities, foreign visitors must be escorted at all times. This includes trips to snack bars, lounges and restrooms.          

The OpDIVs and OS are responsible for establishing and implementing foreign national visitor programs within the framework of the Departmental policy.  

New Employees, Contractors and Affiliates Must Complete & Submit e-QIP to DPSAC Before PIV Card can be Issued!

Effective October, 2014, revised federal policies prohibit the issuance of a badge until the following are completed:

    1. Fingerprint checks are adjudicated
    2. e-QIP and related forms necessary to conduct a background check are completed and submitted by the individual to DPSAC
    3. e-QIP and related forms are reviewed by DPSAC and released to OPM (new requirement)    

Soon after being entered in NED, the new employee, contractor or affiliate will receive an e-mail with the subject line: **MANDATORY** RE: Background Investigation Forms.  

Individuals who have the appropriate investigation on file will not be required to complete new forms

These new policies were issued by the National Institute of Standards and Technology (NIST) in conjunction with the Office of Personnel Management (OPM) and the Department of Health and Human Services (HHS).  

Strange Odor in the Workplace

The following fire safety awareness article was prepared by the Division of the Fire Marshal, ORS  

Know what to do and don't spend time looking for the source of a strange odor - report it by dialing 911 on a NIH phone (301-496-9911 on a cell phone) or 9-911 if off campus and, if necessary, evacuate the area.

August 20, 2014 issue of the DPSAC NEWS

 NIH Encourages Patients and Patient Visitors to Utilize the West Drive Entrance for Easy Campus Access 

Beginning September 1, NIH will implement revised security policies that impact people visiting patients at the Clinical Center. Under the new guidance, a maximum of two individuals will be eligible for Extended Visitor Badges per patient. In the past, the number of badges issued to patient visitors was not limited.

The reason for these changes involves the required security check that must be conducted before an Extended Visitor Badge can be issued. In the past, all patient visitors were subject to a name check through the FBI's National Crime Information Center (NCIC). This criminal history check was free and allowed for expedient issuing of ID badges to patient visitors.

The FBI recently changed its policies for accessing the NCIC databases. NIH must now fingerprint individuals to obtain criminal history information. This fingerprint check currently costs $21.50 per person and will be charged to the sponsoring IC.

Should issues turn up as a result of the FBI fingerprint check, the NIH Extended Visitor Badge may be revoked.

Please note that patients and blood & platelet donors will not be fingerprinted and may be sponsored for a badge by their IC Research Member or from the Department of Transfusion Medicine, respectively.

NIH encourages patient family members and visitors to utilize the dedicated patient entrance on West Cedar Lane.

Patient visitors beyond the two issued Extended Visitor Badges may also use the West Drive entrance to enter the NIH campus. However, they will need to obtain a Daily Visitor Badge at either the West Drive entrance or the Gateway Center.     

PIV Card renewals will trigger badge deactivation for foreign nationals 
Due to limitations in the HHS card management system, AOs who are in the process of renewing the PIV Card of a foreign national after July 1 will cause the individual's current PIV card to be immediately deactivated.

Currently, NED displays the following message to an AO or AT when they change data that will result in the revocation of a person's PIV Card:

Warning: This update contains changes that if approved, will result in the immediate revocation of the individual's current ID badge and require the issuance of a new badge. The individual will need to be re-enrolled per Division of Personnel Security and Access Control (DPSAC) policy.  Please ensure this is the action you desire prior to approving this update. 

To accomplish this, DPSAC is recommending that AOs reach out to their foreign national customers before starting the badge renewal task and explain the importance of picking up their new RLA badge on the same day that their PIV card is revoked.

By coordinating the timing of these two activities, the AO can help foreign nationals obtain their new RLA badges quickly and avoid any interruption to their access privileges at NIH.

Photography, Filming, or Video Recording at the NIH

Permitted Activities:

Individuals may take photographs, films or videos, for personal or news purposes on the grounds of the NIH controlled properties to include entrances, lobbies, foyers, corridors, and auditoriums in use for public meetings, except when contrary to security regulations or signs as indicated below. 

Advertising/Commercial - Photographs and similar activities for advertising or commercial purposes may be taken only with the advance written approval of the Director of the NIH.

(It is strongly recommended this written approval be possessed by the individual taking the photos/films/video at the time when they are taken.  If their actions are questioned by police officers and/or security guards, the written approval should be presented to the police officer/guard as proof of authorization.) 

Patients

A person may take photographs of a patient only with the informed consent of the patient (or the natural or legal guardian) and of the Director of the Warren Grant Magnuson Clinical Center or authorized delegate... . 

Enforcement

Violations of this policy may result in a reprimand, expulsion of the requestor from the NIH premise by the Division of Police or be subject to a fine of not more than $50 or imprisonment of not more than thirty days or both, for each violation (40 U.S.C. 318c)   

DPSAC Wants to Hear from its Customers

DPSAC will soon begin sending out the following message to a randomly selected group of its customers. The purpose is to gather feedback on people's experience with their recent background investigation or badging process. DPSAC is also making the survey available to its customers via the link - "How are we doing? DPSAC wants to hear from its customers" - under the "What's New" section of the DPSAC website main page.

Alternate Logon Tokens (a.k.a., ALT Cards) -- should not be returned to DPSAC. Rather, they should be returned to the appropriate IC's ALT Coordinator. A list of the ALT Coordinators for each IC can be found on the Office of the Chief Information Officer (OCIO) website at: https://ocio.nih.gov/Smartcard/Pages/ALT.aspx#distributor.

FAQs
Q. What is the process for replacing a lost Alternate Logon Token or ALT card? 

A. The individual who lost the card should put in a ticket to the NIH Service Desk. This ticket will be routed to DPSAC staff who will terminate the lost ALT card and sponsor/approve the person for a new ALT card. DPSAC will then send the individual an e-mail stating that the new card is ready to be issued.   

Once the individual has picked up the new ALT card from their IC ALT Coordinator, the ALT Coordinator will record the card as lost and record the newly-issued card.  

New PIV Card Reader Installation for NIH Facilities Nears Completion

DPSAC will complete installation of the new PIV Card readers at 5635 Fishers Lane and Twinbrook I, II, and III on September 3, and at the Bayview Research Center, Baltimore on September 4.  

September 17, 2014 issue of the DPSAC NEWS

Despite Name Change, 'Old' Name Still Appears on Digital Certificates Due to Software Bug

When an individual changes their name in NED, they should be aware that their 'old' name will still appear on their badge's digital certificates. While this is a known bug with the HHS badge management software, it will not affect the individual's login or secure e-mail. Likewise, when an individual transfers to NIH from another HHS operating division (e.g., FDA), their prior organization will still appear in their digital certificates (e.g., OU=FDA).    

Issuance Works Station (IWS) operators and DPSAC Customer Service staff have been alerted to this issue and will now ask the badge holder at the time of re-issuance whether this action (re-issuance) is being requested due to a name change.    

If the answer is yes, staff will be able explain that even though the user's old name/organization will still appear in their certificates due to the HHS software bug, login or secure e-mail will be unaffected... .   

Customers are required to renew their PIV Card before they renew their ALT Card --since individuals must have an active PIV Card to have an ALT Card.  

October 1, 2014 issue of the DPSAC NEWS

FY 2015 OPM Pricing Schedule for Background Investigations

The Office of Personnel Management (OPM) recently published the  

Costs for the eight most commonly ordered investigations at the NIH are posted on the DPSAC website at: http://www.ors.od.nih.gov/ser/dpsac/bgchecks/Pages/pricing.aspx.

October 15, 2014 issue of the DPSAC NEWS

October 29, 2014 issue of the DPSAC NEWS

Credit Checks May Be Required for Some Level I NACI Background Investigations 

While credit checks are not normally part of a Level 1 NACI background investigation, beginning Monday, October 27, individuals who indicate that they have outstanding delinquent federal debt on their OF 306 will be required to complete a credit release.  The OF 306 is a required form for all background investigations.  If an individual answers YES to question 13 on the form (Figure 1), he/she must provide authorization for DPSAC to run the individual's credit report (Figure 2) to collect additional information on the outstanding debt.

November 12, 2014 issue of the DPSAC NEWS

How to obtain Sponsorship approval

If you are a NED AO who does not currently have authority to sponsor, but wish to obtain this ability, you must complete the training found on DPSAC's website under the 'Training/Administrators' section at http://go.usa.gov/fc2e and fax the completion certificate to the HSPD-12 Program Office at 301-480-0108.

Upon receipt of the certificate, the Program Office will authorize you as a sponsor. If the fax does not go through, you should send the PIV Sponsor Certificate via e-mail to Richie Taffet (Taffetr@mail.nih.gov).

Naval Support Activity Bethesda and Walter Reed Announce Tighter Access Privileges Starting November

The following message went out to NIH DC area staff via the ORS Information Line on October 30, 2014 

The NIH has been notified that the Naval Support Activity Bethesda (NSAB) will implement changes to access requirements for NSAB and the Walter Reed National Military Medical Center installation starting November 1, 2014.

These changes will impact all individuals, including government employees not with the Department of Defense (DOD). In general, these enhanced security requirements will limit access to NSAB by NIH employees for other than "official business only."

Only NIH personnel requested to visit NSAB by a permanent staff member will be permitted to use their HHS PIV card to gain access to the campus. All other personnel will be required to go through the visitor security procedures, similar to what is currently conducted at NIH for all visitors, including non-HHS government employees...  

The NIH anticipates access should not change significantly for those NIH employees collaborating with researchers, visiting patients, or giving lectures at the Uniformed Services University.

December 10, 2014 issue of the DPSAC NEWS

 

NED Training Schedule for FY 2015   

Whether you are new to NED or an advanced NED user who needs to hone your NED skills, the HSPD-12 Program Office has a training program for you. These classes are designed to help beginners and advanced users quickly master NED in a hands-on computer lab environment. All classes are FREE!    

AlertNIH Offers Emergency Communication

NIH public safety, human resources, public affairs and facilities representatives, with support from senior leadership, have developed an emergency communication service called AlertNIH.

During a major crisis, emergency or severe weather event, NIH public safety officials will use AlertNIH to send event updates, warnings and instructions directly to employees' government-owned communication devices. Employees have the ability to opt-in to receive these updates on their personal devices too.

In order to enroll your personal device, log into the NIH Enterprise Directory (NED) and scroll to the bottom of your profile to the section titled "AlertNIH." Click the "Edit" button and select the personal devices you wish to receive updates on.